Title: [184189] releases/WebKitGTK/webkit-2.8
- Revision
- 184189
- Author
- [email protected]
- Date
- 2015-05-12 02:24:49 -0700 (Tue, 12 May 2015)
Log Message
Merge r184097 - AX: Crash at WebCore::AccessibilityMenuList::addChildren()
https://bugs.webkit.org/show_bug.cgi?id=144860
Reviewed by Mario Sanchez Prada.
Source/WebCore:
There were some unsafe pointer accesses in AccessibilityMenuList code that needed to be cleaned up.
Test: accessibility/menu-list-crash2.html
* accessibility/AccessibilityMenuList.cpp:
(WebCore::AccessibilityMenuList::addChildren):
LayoutTests:
* accessibility/menu-list-crash2-expected.txt: Added.
* accessibility/menu-list-crash2.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog (184188 => 184189)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog 2015-05-12 09:23:33 UTC (rev 184188)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog 2015-05-12 09:24:49 UTC (rev 184189)
@@ -1,3 +1,13 @@
+2015-05-11 Chris Fleizach <[email protected]>
+
+ AX: Crash at WebCore::AccessibilityMenuList::addChildren()
+ https://bugs.webkit.org/show_bug.cgi?id=144860
+
+ Reviewed by Mario Sanchez Prada.
+
+ * accessibility/menu-list-crash2-expected.txt: Added.
+ * accessibility/menu-list-crash2.html: Added.
+
2015-05-07 Zalan Bujtas <[email protected]>
REGRESSION (r164449): Subpixel rendering: http://www.apple.com/iphone-6/ "Faster wireless." image displays vertical black line on 1x displays at specific window width.
Added: releases/WebKitGTK/webkit-2.8/LayoutTests/accessibility/menu-list-crash2-expected.txt (0 => 184189)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/accessibility/menu-list-crash2-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/accessibility/menu-list-crash2-expected.txt 2015-05-12 09:24:49 UTC (rev 184189)
@@ -0,0 +1,13 @@
+TEST
+TEST
+This tests that there's no crash if we hide menu list and then try to access accessibility information.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Role before removal: AXRole: AXPopUpButton
+Role after removal: AXRole:
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: releases/WebKitGTK/webkit-2.8/LayoutTests/accessibility/menu-list-crash2.html (0 => 184189)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/accessibility/menu-list-crash2.html (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/accessibility/menu-list-crash2.html 2015-05-12 09:24:49 UTC (rev 184189)
@@ -0,0 +1,48 @@
+<html>
+<head>
+<script src=""
+</head>
+<body>
+
+TEST
+<div id="content">
+
+<select id="menulist">
+ <option selected>One</option>
+ <option>Two</option>
+ <option>Three</option>
+</select>
+
+</div>
+TEST
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+function runTest() {
+ description("This tests that there's no crash if we hide menu list and then try to access accessibility information.");
+
+ if (window.accessibilityController) {
+ var menulist = document.getElementById("menulist");
+ menulist.focus();
+ menulist.selectedIndex = 1;
+
+ var accessibleMenulist = accessibilityController.focusedElement;
+ debug("Role before removal: " + accessibleMenulist.role);
+
+ menulist.style.display = "none";
+ gc();
+
+ // Don't crash!
+ debug("Role after removal: " + accessibleMenulist.role);
+ }
+}
+
+runTest();
+</script>
+
+</body>
+<script src=""
+</html>
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog (184188 => 184189)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-12 09:23:33 UTC (rev 184188)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-12 09:24:49 UTC (rev 184189)
@@ -1,3 +1,17 @@
+2015-05-11 Chris Fleizach <[email protected]>
+
+ AX: Crash at WebCore::AccessibilityMenuList::addChildren()
+ https://bugs.webkit.org/show_bug.cgi?id=144860
+
+ Reviewed by Mario Sanchez Prada.
+
+ There were some unsafe pointer accesses in AccessibilityMenuList code that needed to be cleaned up.
+
+ Test: accessibility/menu-list-crash2.html
+
+ * accessibility/AccessibilityMenuList.cpp:
+ (WebCore::AccessibilityMenuList::addChildren):
+
2015-05-11 Zan Dobersek <[email protected]>
Reduce TransformationMatrix copies in WebKitCSSMatrix operations
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/accessibility/AccessibilityMenuList.cpp (184188 => 184189)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/accessibility/AccessibilityMenuList.cpp 2015-05-12 09:23:33 UTC (rev 184188)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/accessibility/AccessibilityMenuList.cpp 2015-05-12 09:24:49 UTC (rev 184189)
@@ -58,10 +58,13 @@
void AccessibilityMenuList::addChildren()
{
- m_haveChildren = true;
-
- AXObjectCache* cache = m_renderer->document().axObjectCache();
-
+ if (!m_renderer)
+ return;
+
+ AXObjectCache* cache = axObjectCache();
+ if (!cache)
+ return;
+
AccessibilityObject* list = cache->getOrCreate(MenuListPopupRole);
if (!list)
return;
@@ -72,6 +75,7 @@
return;
}
+ m_haveChildren = true;
m_children.append(list);
list->addChildren();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
